CVE-2022-25237

Think of this like a side door in a building that's supposed to require a badge, but if you knock in just the right pattern, the door opens without checking your badge at all. Anyone on the internet who knows the trick can walk into restricted areas of the Bonita Web application and potentially take control of the whole system — no password needed.

This matters to you if your organization runs Bonita Web, particularly version 2021.2, for business process management or workflow automation. It's especially urgent if that system is accessible from the internet, since no login is required for an attacker to exploit it.

This is a red-alert situation: a public exploit already exists for this flaw, meaning attackers have the tools needed to break in without any credentials. Combined with sustained press attention and no confirmed patch yet, businesses running the affected version should assume active risk and act now rather than wait.

1. Confirm the running Bonita Web version; this flaw affects 2021.2 due to an overly broad exclude pattern in RestAPIAuthorizationFilter that misclassifies crafted URL suffixes (e.g., ';i18ntranslation', '/../i18ntranslation/') as unauthenticated-safe paths.
2. No fixed version is confirmed in current findings — check directly with Bonitasoft for an official patch or hotfix release addressing this CVE, as vendor advisories may update independently of this report.
3. As a temporary workaround, place a reverse proxy or WAF rule in front of Bonita Web to block requests containing 'i18ntranslation' path segments or similar exclude-pattern bypass strings, and restrict REST API endpoint access to authenticated sessions only at the network layer.
4. If internet-facing, consider taking the application offline or restricting to VPN/internal access until the authorization filter issue is resolved.
5. Monitor access logs for anomalous requests to privileged REST API paths and any ';i18ntranslation'-style suffixes, which indicate exploitation attempts.
6. Given a public exploit exists and EPSS predicted exploitation likelihood was very high (99th percentile) before declining, prioritize this as a critical, actively-targetable issue even though it is not yet in CISA's KEV catalog.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. Weakness class: CWE-Other (authorization bypass via flawed filter exclude pattern). A working public exploit is known to exist, and EPSS scored this at 56.4% (99th percentile, trend falling) reflecting very high predicted exploitation likelihood, though it is not currently listed in CISA's KEV catalog. Sustained press attention has kept this vulnerability visible, but no official patch information is available in current findings.